Your privacy in brief
This statement explains how we handle your personal data under the General Data Protection Regulation (GDPR).
- We do not use advertising trackers or visitor profiles.
- Optional usage measurement is performed only with your consent. Through ‘Privacy Choice’ at the bottom of the website, you can always adjust that choice.
- Answers you submit via the protected customer environment are stored encrypted.
- We apply established retention periods. Below you can read which data we process, why, for how long, and how you can exercise your rights.
1. Data controller
Laurens De Leeuw
Company number: BE0695.421.308
Privacy contact: via the privacy form or info@charternine.com.
2. Contact and information requests
When you use the form, we process your email address, and only if you fill them in yourself: name, organization, domain, and message. The purpose is to answer your question and, if you request it, to take preparatory steps for a possible agreement.
Ordinary information requests are kept in the request register for a maximum of 90 days. The technical expiration date is after 89 days; a daily automated cleanup removes the record at the latest within the following 24 hours. If an agreement, legal obligation, or dispute demonstrably requires a different period, we document that separately. You share sensitive access data exclusively in your secured customer environment.
Privacy requests and security notifications remain available as long as their processing requires it. After processing, we delete the original form message. Only a brief decision with reason and date is retained: 24 calendar months for rights requests and three calendar years for incident handling. We do not store passwords or full copies of affected data.
To keep the contact form available for genuine requests, we use Cloudflare Turnstile for bot protection. Turnstile processes the necessary browser and network signals for this, such as the IP address, the TLS fingerprint, the user agent, the site key, and the origin of the request. The Turnstile bot check does not receive the content of your form fields. The website hosting does process the form request in order to receive and handle your request securely. This protection is based on our legitimate interest in protecting the form against automated abuse. Cloudflare processes these signals on our behalf for that protection and additionally as a data controller to further improve bot detection. More information can be found in the Cloudflare Turnstile Privacy Addendum.
3. Certificate verification
The entered domain name is used solely for the exact registry check. A POST request keeps the domain name out of the page URL, search history, and referrer. The entered domain name is not added to the certificate registry or saved as search history.
For abuse limitation, the application temporarily uses a daily changing pseudonymous client code with a request counter. The entered domain name is not part of this counter. Counters older than 24 hours are removed during the daily cleanup, normally at the latest within 48 hours after the start of their counting period.
4. Certificate register
For issued certificates, we publish domain data for the stated purpose: exact domain name, status, assessment scope, assessment dates, expiry date, framework version and a random public certificate ID. Checking one exact domain protects the privacy of the complete customer list.
5. Secure customer area
For the execution of assignments, we store customer contact information, project agreements, necessary research results, and certificate decisions in a secure file. The short retention period for completed portal responses below does not automatically apply to this file. Public certificate information and internal research data have separate retention periods. Customer and project data are retained during the assignment and for 24 calendar months after final closure. Detailed research information expires 24 calendar months after the later of the completed report or the end of the associated certificate period. An extension does not start a new term for old research. The minimum internal certificate decision and withdrawal process are retained for five calendar years after the definitive end. This period does not apply to all free text or customer data and does not mean five years of public file information.
For project information and access data, the client receives a personal, one-time access link and a client code. The code can be shared separately. After confirmation, the environment uses a strictly necessary secure session cookie that remains valid for one hour. Before it expires, you can choose another hour with a button; this never happens automatically.
The responses are encrypted before storage and linked exclusively to the correct customer file. The administrator chooses in advance an availability period of 1 up to a maximum of 30 days after submission. After this period, access is immediately blocked, and the encrypted record is removed during the next daily cleanup. Access by the logged-in administrator requires a one-time email code for the selected submission and is recorded in the internal audit log. The code expires after five minutes; the associated temporary audit data is removed during the daily cleanup.
6. Admin login
The management environment uses a separate administrator account. The configured email address remains in the protected runtime configuration; in the database we only store a secure derived value of it. The chosen password is also stored only as a strongly derived check value.
After a successful administrator sign-in with the separate administrator password, the website sends a one-time code to the configured administrator mailbox through its own mail delivery service on OVHcloud and Combell’s SMTP mail service. The website decides whether to grant access. Administrator sign-in uses Cloudflare Turnstile against automated sign-in attempts and a strictly necessary secure session cookie. A new session remains valid for thirty days, including after restarting the browser. Activity does not extend that period. Before it expires, you can explicitly choose fifteen additional minutes of working time up to ten times. You then need to sign in again. Signing out ends the session immediately.
The mail delivery service processes security codes and operational notifications for the fixed administration address. The code register contains a random request number, timestamp and delivery status for a maximum of 61 minutes during normal operation. For notifications, we retain a random message number, a technical fingerprint, timestamp and delivery status for a maximum of 90 days to limit duplicate delivery. Codes and message content are not stored in these registers or application logs.
Temporary login codes expire after five minutes. Pseudonymized limits help restrict repeated attempts and misuse. Regular management, access, and authentication events are retained for 365 days to investigate suspicious access and monitor the operation of access security. Older entries are removed at the next daily cleanup, usually within 24 hours.
7. Centrally hosted badge
The certificate badge is provided by Charter Nine so that it automatically follows the current certificate status. The badge does not set cookies, and the supplied embed snippet uses a no-referrer setting to avoid sending the customer page on which it appears. The application does not create visitor profiles from badge views.
8. Service providers, hosting and data transfers
The website and the associated data storage run on our server at OVHcloud. The hosting processes technically necessary data, such as IP addresses, request data, and browser data, to make the website and the secure customer environment work.
In addition, we use Cloudflare Turnstile for the bot protection described in parts 2 and 6. The in-house sending service runs on OVHcloud; Combell provides the SMTP mail facility. This sending service processes management codes and notifications about received requests, secure submissions, and certificate deadlines. Notifications contain only a reference, relevant dates, and a link to the secure management; no customer message, customer email address, or filled-in access data. The notification queue on the website is cleaned up after 90 days. For an ongoing certificate cycle, the minimum sending record is retained as long as necessary to prevent repeated deadline notifications.
For recovery after a failure, we also keep encrypted application exports of the website data on the server at OVHcloud and in a secure storage location outside that server. The key to open those copies is not on that server. These copies are separate from the mail delivery service and are removed during normal operation within a maximum of seven days. Before a backup is put back into use, deletions and revoked access since the recovery point must be checked and processed.
The rotation and separate recovery key above apply to our application exports. Backups of the entire server at OVHcloud and mailbox copies at Combell are separate provider services with their own terms and retention periods.
These services use international infrastructure. Therefore, we do not promise storage that takes place exclusively in Belgium or the European Economic Area. This applies, among other things, to bot protection and the receipt of security emails. Information about the hosting conditions can be found at OVHcloud. The previous application environment at ChatGPT Sites has been shut down and the active application data has been removed there. Any technical recovery copies from that hosting provider fall under its contractual deletion agreements.
The retention periods in this statement describe our application registers. Technical network and security logs at the service providers are subject to their own service terms and privacy information. That processing is separate from the optional daily counts from Part 9.
9. Cookies and external content
We choose the language using the language settings sent by your browser. If you choose a language yourself, the functional c9_language cookie remembers only that choice for one year. We do not use this language preference to profile visitors or for optional usage measurement.
The proprietary fonts, images, and site scripts are delivered from this website. We do not use advertising trackers or visitor profiles. The client environment and management environment use strictly necessary secure session cookies. Cloudflare Turnstile protects the forms as described in sections 2 and 6.
Only with your consent does Charter Nine count the use of contact buttons, successfully received general information requests, and certificate checks. We only store totals per day and type of action, for a maximum of 90 days. The measurement register contains no IP addresses, visitor codes, entered domain names, messages, page URLs, or referring websites. The totals indicate numbers of actions, not numbers of unique visitors.
With the cookie c9_measurement we remember for 180 days whether you allow or refuse this measurement. This cookie contains only your choice and its version. Measurement does not take place without consent. You can always change your choice through "Privacy choice" at the bottom of public pages. Refusing does not affect how the website works. Withdrawal stops future measurement; earlier daily totals are not linked to you.
10. Your data remains purpose-bound
We process requests and orders in order to prepare or execute an agreement at your request, when you are the contracting party yourself. For business contacts, we use the legitimate interest to carefully handle business questions and orders. Necessary access security and abuse prevention serve our legitimate interest to protect the service and data. Legally required rights requests are processed to comply with those obligations. Optional usage measurement is done solely with your consent. Marketing communications are only sent when separate and optional consent has been given for this.
11. Your rights
Depending on your situation, you may request access, rectification, erasure, restriction, portability or object to processing. Submit your request securely through the privacy form or email info@charternine.com. Do not share passwords or access codes via email. We may request reasonable information to prevent misuse of another person's rights.
You will generally receive a response within one calendar month. If more time is needed due to complexity or the number of requests, we will inform you of that within that first month, with the reason.
You can also file a complaint with the Belgian Data Protection Authority.
12. Security and incidents
We use appropriate technical and organizational measures, including encrypted transport, restricted input, access limitation, security headers, minimal logging, and timely deletion. We regularly evaluate these measures and improve them when technology, usage, or risks change.
13. Changes
Material changes receive a new version date. The most recent statement remains available on this fixed page.